Skip to content

Commit

Permalink
Dropping a removed feature. Closes #12.
Browse files Browse the repository at this point in the history
  • Loading branch information
mikewest committed Oct 9, 2024
1 parent a7fae91 commit 31e9116
Showing 1 changed file with 0 additions and 6 deletions.
6 changes: 0 additions & 6 deletions README.markdown
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,6 @@ the moment:
if it contains known-good content. For example, the user agent ensures that script loaded via
"`<script src='whatever.js' integrity='sha256-...'>`" will only execute when a SHA256 hash of
the script's content matches the specified integrity attribute.

* Content Security Policy can layer on top of Subresource Integrity to ensure that [integrity
checks are required][require-sri-for] for script execution, and [specifying a list of acceptable
hashes][external]. For example, the policy "`script-src 'sha256-abc' 'sha256-zyx';
require-sri-for script`" would ensure that script executes only when it matches one of the
specified hashes, regardless of the server that delivered it.

These existing mechanisms are effective, but they also turn out to be somewhat onerous for both
development and deployment. Policies that restrict sources of content need to be quite granular in
Expand Down

0 comments on commit 31e9116

Please sign in to comment.